locked
Windows 7 Activated But Get not genuine message RRS feed

  • Question

  • I have a Dell laptop that had the disk crash.  Rebuilt it using a Retail copy of Windows 7 and used the Registration Key on the COA.  When I activatged it succeeded and even put the Genuine log is the System Properties.   Several hours later, I get the popup that I may be the victim of counterfitting and that this version is not genuine.  I reentered the key and even tried activating by telephone and got the same result.  If I go to the Get Genuine website, I am told that my copy is genuine.  My copy of the Diag is below.  One thing I notice is the product key shown is not the key I entered.  It may be the original Dell OEM key.

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
    Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
    Windows Product ID: 00359-OEM-8992687-00095
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {962DC190-3499-42B5-A1C8-C7F8B016EEB2}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.120503-2030
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{962DC190-3499-42B5-A1C8-C7F8B016EEB2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-3548137055-96496508-2867800813</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1545                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A14</Version><SMBIOSVersion major="2" minor="4"/><Date>20091207000000.000000+000</Date></BIOS><HWID>84AA3A07018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
    Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00196-049-143223-02-1033-7601.0000-2692012
    Installation ID: 002163113422821604228146643714427023703281375851922071
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: MX9QY
    License Status: Licensed
    Remaining Windows rearm count: 1
    Trusted time: 9/25/2012 10:49:10 AM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 9:24:2012 23:36
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: MgAAAAEAAQABAAMAAAABAAAAAwABAAEA6GHwUi6f2jPk1nYOKB/OcFRtmneeTFYPRso=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   DELL    WN09  
      FACP   DELL    WN09  
      HPET   DELL    WN09  
      MCFG   DELL    WN09  
      SLIC   DELL    WN09  
      SSDT   PmRef  CpuPm


    andy

    Tuesday, September 25, 2012 4:29 PM

Answers

All replies

  • The Key in use here is NOT the one from the COA- it's the OEM_SLP Key which is only valid when used with themanufacturer's  Recovery media.

    Have you been using any form of Registry Cleaner?? - there are residues of what may be your COA Key present (last characters are MX9QY)

    I would suggest recreating the licensing store....

    Recreate the Licensing Store

    • Go to Start > All Programs > Accessories
    • Right-Click      on Command Prompt and select Run as      Administrator - accept the UAC prompt
    •  Run the following commands in the Command      Prompt window, using the Enter key at the end of each

     

    net stop sppsvc

    (wait until the service has stopped before entering the following lines)

     

    CD %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
    REN tokens.dat tokens.bar
    net start sppsvc
    slui.exe

    • After a      couple of seconds Windows Activation dialog will appear.
    • You may be      asked to re-activate and/or re-enter your product key or Activation may      occur automatically.
    • If you are      asked for your Key, use the one on the COA sticker on the machine's case

    Reboot and Post back with a new MGADiag report


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Tuesday, September 25, 2012 4:47 PM
    Moderator
  • Thanks for the suggestion.  What I found is the sppsvc was not running and there was no tokens.dat file.  I started the service ran SLUI and it looks like it is working.

    andy

    Tuesday, September 25, 2012 5:13 PM
  • It's not unusual for the service not to be running - but it must run when the MGADIag report is run.

    There was nothing wrong with the service as such.

    The problem was that the partof the registry which contained your COA Key was corrupted - possibly due to a registry cleaner of some kind.

    Please post a new MGADiag report so that we can check that all is now OK.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, September 25, 2012 5:33 PM
    Moderator
  • The diag still has the old key:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
    Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
    Windows Product ID: 00359-OEM-8992687-00095
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {962DC190-3499-42B5-A1C8-C7F8B016EEB2}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.120503-2030
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{962DC190-3499-42B5-A1C8-C7F8B016EEB2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-3548137055-96496508-2867800813</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1545                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A14</Version><SMBIOSVersion major="2" minor="4"/><Date>20091207000000.000000+000</Date></BIOS><HWID>84AA3A07018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
    Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00196-049-143223-02-1033-7601.0000-2692012
    Installation ID: 002163113422821604228146643714427023703281375851922071
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: MX9QY
    License Status: Licensed
    Remaining Windows rearm count: 1
    Trusted time: 9/25/2012 12:46:34 PM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 9:24:2012 23:36
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: MgAAAAEAAQABAAMAAAABAAAAAwABAAEA6GHwUi6f2jPk1nYOKB/OcFRtmneeTFYPRso=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   DELL    WN09  
      FACP   DELL    WN09  
      HPET   DELL    WN09  
      MCFG   DELL    WN09  
      SLIC   DELL    WN09  
      SSDT   PmRef  CpuPm


    andy

    Tuesday, September 25, 2012 5:49 PM
  • Please use the procedure I posted earlier - give details of any error messages encountered

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, September 25, 2012 6:43 PM
    Moderator
  • Ran through all the steps (sppsvc was stooped when net stop was run).  I renamed the tokens.dat file and ran slui.exe.  Right away I get the "Activation was Successful" message with thew Genuine logo.  No reentering of the key was required.  The tokens.dat file has not been recreated as of yet.

    andy

    Tuesday, September 25, 2012 7:10 PM
  • OK - please reboot, and post a new MGADiag report.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, September 25, 2012 7:43 PM
    Moderator
  • Ok, rebooted and reran MGADiag.  It runs but when I press the Copy button, I get an error: "Failed to createoutput files.  hr=0x80070002 Please contact support.  The Tokens.dat file still is non existent.

    andy

    Tuesday, September 25, 2012 8:18 PM
  • Ignore the error message - it should still paste to your reply.

    Please also run the following commands and post the results.

    DIR %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform

    ICACLS %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform




    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, September 25, 2012 9:07 PM
    Moderator
  • Here is the result of the cmd:

    e in drive C has no label.
     Volume Serial Number is 3008-A429

     Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform

    09/25/2012  07:25 PM    <DIR>          .
    09/25/2012  07:25 PM    <DIR>          ..
    08/31/2012  12:01 AM    <DIR>          Cache
    09/25/2012  12:16 AM         4,523,643 tokens.bar
                   1 File(s)      4,523,643 bytes
                   3 Dir(s)  210,034,831,360 bytes free
    C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform ANITA-PC\Anita:(F)
                                                                                                   NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                                                                                                   BUILTIN\Administrators:(I)(OI)(CI)(F)
                                                                                                   NT AUTHORITY\NETWORK SERVICE:(I)(OI)(CI)(F)
                                                                                                   ANITA-PC\Anita:(I)(OI)(CI)(F)

    Successfully processed 1 files; Failed processing 0 files

    Here is the MGADiag output:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
    Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
    Windows Product ID: 00359-OEM-8992687-00095
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {962DC190-3499-42B5-A1C8-C7F8B016EEB2}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.120503-2030
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{962DC190-3499-42B5-A1C8-C7F8B016EEB2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-3548137055-96496508-2867800813</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1545                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A14</Version><SMBIOSVersion major="2" minor="4"/><Date>20091207000000.000000+000</Date></BIOS><HWID>84AA3A07018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
    Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00196-049-143223-02-1033-7601.0000-2692012
    Installation ID: 002163113422821604228146643714427023703281375851922071
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: MX9QY
    License Status: Licensed
    Remaining Windows rearm count: 1
    Trusted time: 9/25/2012 7:17:21 PM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 9:24:2012 23:36
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: MgAAAAEAAQABAAMAAAABAAAAAwABAAEA6GHwUi6f2jPk1nYOKB/OcFRtmneeTFYPRso=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   DELL    WN09  
      FACP   DELL    WN09  
      HPET   DELL    WN09  
      MCFG   DELL    WN09  
      SLIC   DELL    WN09  
      SSDT   PmRef  CpuPm


    andy

    Wednesday, September 26, 2012 12:29 AM
  • Tne  command results are normal (apart from missing the tokens.dat file) - the MGADiag result hasn't changed.

    I wonder......

    Please run the following commands..

    ICACLS C:\Windows\ServiceProfiles\NetworkService

    ATTRIB C:\Windows\ServiceProfiles\NetworkService\*.*

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\hivelist

    post the results


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Wednesday, September 26, 2012 1:37 AM
    Moderator
  • C:\Windows\ServiceProfiles\NetworkService NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                              BUILTIN\Administrators:(OI)(CI)(F)
                                              NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(F)
                                              ANITA-PC\Anita:(OI)(CI)(F)

    Successfully processed 1 files; Failed processing 0 files
    A  SH   I    C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    A   H        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG
    A   H        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1
    A   H        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2
    A  SH        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
    A  SH        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
    A  SH        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
    A  SH        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{b530f446-624f-11e1-8ec8-806e6f6e6963}.TM.blf
    A  SH        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{b530f446-624f-11e1-8ec8-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
    A  SH        C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT{b530f446-624f-11e1-8ec8-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist
        \REGISTRY\MACHINE\HARDWARE    REG_SZ   
        \REGISTRY\MACHINE\BCD00000000    REG_SZ    \Device\HarddiskVolume2\Boot\BCD
        \REGISTRY\MACHINE\SYSTEM    REG_SZ    \Device\HarddiskVolume3\Windows\System32\config\SYSTEM
        \REGISTRY\MACHINE\SOFTWARE    REG_SZ    \Device\HarddiskVolume3\Windows\System32\config\SOFTWARE
        \REGISTRY\USER\.DEFAULT    REG_SZ    \Device\HarddiskVolume3\Windows\System32\config\DEFAULT
        \REGISTRY\MACHINE\SECURITY    REG_SZ    \Device\HarddiskVolume3\Windows\System32\config\SECURITY
        \REGISTRY\MACHINE\SAM    REG_SZ    \Device\HarddiskVolume3\Windows\System32\config\SAM
        \REGISTRY\USER\S-1-5-20    REG_SZ    \Device\HarddiskVolume3\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
        \REGISTRY\USER\S-1-5-19    REG_SZ    \Device\HarddiskVolume3\Windows\ServiceProfiles\LocalService\NTUSER.DAT
        \Registry\User\S-1-5-21-3548137055-96496508-2867800813-1001    REG_SZ    \Device\HarddiskVolume3\Users\Anita\NTUSER.DAT
        \Registry\User\S-1-5-21-3548137055-96496508-2867800813-1001_Classes    REG_SZ    \Device\HarddiskVolume3\Users\Anita\AppData\Local\Microsoft\Windows\UsrClass.dat

     


    andy

    Wednesday, September 26, 2012 1:52 AM
  • That all looks normal enough -  but let's look a little closer....

    run the following commands in an Elevated command prompt, and post the results

    DIR  C:\Windows\ServiceProfiles\NetworkService /ah

    COPY C:\Windows\System32\winevt\Logs\Application.evtx %userprofile%\desktop

    COPY C:\Windows\System32\winevt\Logs\System.evtx %userprofile%\desktop

    With luck, there's be something in the Event Viewer - please compress  the two .evtx files that have appeared on the desktop to a zip or rar file and upload the resulting file to your SkyDrive - post a link (you can delete the two evtx files from the desktop - what you do with the zipfile is up to you, but keep it handy for a couple of days in case I have a problem downloading).


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Wednesday, September 26, 2012 9:45 AM
    Moderator
  • Noel,

    Afraid I screwed the pooch as I cleared the logs this morning.  There were no Critical Errors in it.  I did compress the files and put them at https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!142&authkey=!AHemLXKcXL_POc0

    Interesting thing I have found.  If I run Windows Update, I get the error that I may be a victim of counterfiting.  If I turn around and run SLUI, I get Windows is Activated with a Genuine Logo.


    andy

    Wednesday, September 26, 2012 2:15 PM
  • This smacks of an Activation exploit being installed and interposing itself in the process.

    There are a couple of interesting errors in the logs...


    C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x80070241, 0x80004005

     The first error is a 'could not confirm digital signature'

    the second is errfectively 'access denied', I think.

    The only other timeI've seen this error, it may have been caused by corruption of the NlsLexicons0009.dll  file.

    You may have done this before, but please repeat it, and upload the CBS.log afterwards.....

    Please run a full CHKDSK and SFC scan....

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     At the Command prompt, type

     CHKDSK C: /R

     and hit the Enter key.

     You will be told that the drive is locked,

     and the CHKDSK will run at he next boot - hit the Y key, and then reboot.

     The chkdsk will take a few hours depending on the size  of the drive, so be patient!

     After the CHKDSK has run, Windows should boot normally  (possibly after a second auto-reboot) - then run the SFC.

     SFC -System File Checker - Instructions

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     At the Command prompt, type

     SFC /SCANNOW

     and hit the Enter key

     Wait for the scan to finish - make a note of any error messages - and then reboot.

     Copy the CBS.log file created to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.

    Post a new MGADiag report with details of any error messages encountered.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Wednesday, September 26, 2012 3:19 PM
    Moderator
  • Noel,

    The SFC did find a corrupt sppwinobj.dll but could't repair it.  Here is the CBS.log: https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!143&authkey=!AFi68tq5buyHQCU


    andy


    • Edited by andytheman Thursday, September 27, 2012 5:11 AM
    Thursday, September 27, 2012 4:10 AM
  • odd - tehere's nothing in MGADiag about that?

    It's not the only unrepairable error, either....

    2012-09-26 23:00:06, Info                  CSI    000002ee [SR] Verify complete
    2012-09-26 23:00:06, Info                  CSI    000002ef [SR] Repairing 4 components
    2012-09-26 23:00:06, Info                  CSI    000002f0 [SR] Beginning Verify and Repair transaction
    2012-09-26 23:00:06, Info                  CSI    000002f1 [SR] Cannot verify component files for Microsoft-Windows-InternetExplorer-Optional-Deployment-LanguagePack, Version = 9.4.8112.16421, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
    2012-09-26 23:00:06, Info                  CSI    000002f2 [SR] Cannot verify component files for Microsoft-Windows-InternetExplorer-OOB-Deployment-LanguagePack, Version = 9.4.8112.16421, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
    2012-09-26 23:00:06, Info                  CSI    000002f3 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.1.7600.16385_none_2e6dc451c0fa9db5\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
      Found: {l:32 b:as3OOcx5px0XiJa7f7s9BVvlW/FFlKR4NMU/T+UP/Kg=} Expected: {l:32 b:ENtKeUct91LKlHclgfWTvnCdCOHHwDe+SYrPzZTTezU=}
    2012-09-26 23:00:06, Info                  CSI    000002f4 [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
    2012-09-26 23:00:06, Info                  CSI    000002f5 [SR] Cannot repair member file [l:24{12}]"sppwinob.dll" of Microsoft-Windows-Security-SPP-Plugin-Windows, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
    2012-09-26 23:00:06, Info                  CSI    000002f6 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.1.7600.16385_none_2e6dc451c0fa9db5\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
      Found: {l:32 b:as3OOcx5px0XiJa7f7s9BVvlW/FFlKR4NMU/T+UP/Kg=} Expected: {l:32 b:ENtKeUct91LKlHclgfWTvnCdCOHHwDe+SYrPzZTTezU=}
    2012-09-26 23:00:06, Info                  CSI    000002f7 [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
    2012-09-26 23:00:06, Info                  CSI    000002f8 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
    2012-09-26 23:00:06, Info                  CSI    000002f9 Hashes for file member \??\C:\Windows\System32\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
      Found: {l:32 b:as3OOcx5px0XiJa7f7s9BVvlW/FFlKR4NMU/T+UP/Kg=} Expected: {l:32 b:ENtKeUct91LKlHclgfWTvnCdCOHHwDe+SYrPzZTTezU=}
    2012-09-26 23:00:06, Info                  CSI    000002fa Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.1.7600.16385_none_2e6dc451c0fa9db5\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
      Found: {l:32 b:as3OOcx5px0XiJa7f7s9BVvlW/FFlKR4NMU/T+UP/Kg=} Expected: {l:32 b:ENtKeUct91LKlHclgfWTvnCdCOHHwDe+SYrPzZTTezU=}
    2012-09-26 23:00:06, Info                  CSI    000002fb [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"tcpmon.ini"; source file in store is also corrupted
    2012-09-26 23:00:06, Info                  CSI    000002fc [SR] Cannot repair member file [l:24{12}]"sppwinob.dll" of Microsoft-Windows-Security-SPP-Plugin-Windows, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
    2012-09-26 23:00:06, Info                  CSI    000002fd [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
    2012-09-26 23:00:06, Info                  CSI    000002fe [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:24{12}]"sppwinob.dll"; source file in store is also corrupted
    2012-09-26 23:00:06, Info                  CSI    000002ff Repair results created:
    

    I'll have to see if I can craft a repair method - if you haven't heard back in 24 hours, shout at me :)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, September 27, 2012 7:09 AM
    Moderator
  • Noel,

    Any luck with a repair otion?


    andy

    Friday, September 28, 2012 9:45 PM
  • Oooops! sorry, real life got in the way :(

    I'm on it - back soon.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, September 29, 2012 8:26 AM
    Moderator
  • There's two files at least, there that should, I believe , be fixed by running the CheckSUR tool - and it's always better to fix them that way, if possible (and it'll give better detail on the remaining errors anyhow)

    Please download and run the Win7 64-bit version of the tool, from here...

    http://support.microsoft.com/kb/947821

     

    then zip the CheckSUR.log and upload it to your public SkyDrive so I can take a look - post a link in your reply.

    The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and will exit silently - it may appear to freeze for most of that time, but be patient.



    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, September 29, 2012 8:52 AM
    Moderator
  • Noel,

    No issue with you taking care of the rest of your life.  :)  

    Here is the link to the log: https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!144&authkey=!AA8jkpVG5S2Kwhw


    andy

    Saturday, September 29, 2012 4:39 PM
  • That was short and sweet :)

    I'm not sure why the other missing files aren't recorded in the final summary as well as the two manifest files - I need to check up on that before I attempt a repair.

    Back tomorrow (promise!)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, September 29, 2012 7:50 PM
    Moderator
  • As promised :)

    A word of warning - I'm still very much a beginner at using the CheckSUR tool to repair faults in the WinSxS folder!

    So we'll take little baby steps - and hopefully I won't make any mistakes.

    Now you've run the CheckSUR tool it will have created a a few new folders in the file structure which we need to use -


    Warning: this fix is specific to the user in this
    thread. No one else should follow these instructions as it may cause more harm
    than good. If you are after assistance, please start a thread of your own.

    (I will delete the file after the thread is closed to prevent abuse)

    Please download the file, Manifests.zip and save this to
    your Desktop.

    Right-click on the file and select Extract All...

    Tick the box labelled Show extracted files when complete then click Extract

    A window will open showing one folder Manifests

    Open the Manifests folder and copy the files into the following folder

    C:\Windows\Temp\CheckSur\Winsxs\Manifests

    Run the System Update Readiness Tool (CheckSUR) again

    When CheckSUR finishes installing,

    please zip and upload both the new CheckSUR.log file, and all CheckSUR.persist.log files

    Post a link, and the details of any error messages encountered.

    Hopefully, that will have fixed the two identified errors - and we'll end up with a new list of errors to solve :)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 30, 2012 12:51 AM
    Moderator
  • Noel,

    Thanks for your help!  No error messages running CheckSur.  Here are the log files: https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!146&authkey=!AMfp0wFXxj58O48


    andy

    Sunday, September 30, 2012 1:41 AM
  • Great - that's done exactly what it's supposed to have done, and it hasn't created any new entries in the log.

    Now we have to try and replace the payload foles that are missing.

    There are two ways of doing this - either using the CheckSUR tool, or a manual repair.

    I'm not happy that I know the tool well enough to be able to get it right that way, so we're left with a manual repair. (I'm going to ask a friend with more knowledge to craft a repair for me as a teaching exercise - but that could take a week or so, as I know he's busy)

    The first question is - do you have access to the 'Repair your Computer' option if you use an F8 boot?

    If so, then we can proceed without waiting, using the manual repair

    If not, then things get a little difficult, and we may have to wait.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 30, 2012 9:18 AM
    Moderator
  • Assuming you do have access to the Repair Your Computer option - this is what to do.

    Download the sprepair2.zip file from my Skydrive and save it to your desktiop

    Extract All to C:\  (this will create a new folder C:\sprepair2)

    Now boot to the Repair Environment ('Repair your Computer') and open a Command Prompt window.

    At the prompt, type the command

    XCOPY C:\sprepair2 C:\Windows\winsxs /S /Y

    this will only take (hopefully) a couple of seconds and you'll be returned to the Command Prompt.

    close the window and Click on Restart.

    Boot to Normal Mode Windows as usual.

    Now run another SFC /SCANNOW (and keep your fingers crossed!) then reboot

    attempt validation at www.microsoft.com/genuine/validate

    post the new CBS.log and the validation result, together with a new MGADiag report.

    Let's see where that gets us :)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth



    Sunday, September 30, 2012 10:01 AM
    Moderator
  • I'll be able to try this later this evening.

    andy

    Sunday, September 30, 2012 5:58 PM
  • No hurry :)

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 30, 2012 6:13 PM
    Moderator
  • Noel,

    Did this and it looks like that did the trick.  The sfc still had the error that not all the corruptions could be fixed.   Here are the logs you requested: https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!146&authkey=!AMfp0wFXxj58O48 .

    The Counterfeit warning on the desktop is gone and I don't get the Counterfeit dialog when I run Windows update.


    andy

    Sunday, September 30, 2012 11:31 PM
  • Great - but let's not celebrate yet,

    Please post a new MGADiag report and post the results.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 30, 2012 11:37 PM
    Moderator
  • .... I don't see a new CBS.log?? (both CheckSUR logs, but no CBS log)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 30, 2012 11:40 PM
    Moderator
  • Noel,

    Sorry, they are in th3 093012.zip file.


    andy

    Monday, October 1, 2012 12:22 AM
  • I don't seem to have access to that - please post a new link.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, October 1, 2012 8:19 AM
    Moderator
  • Monday, October 1, 2012 1:34 PM
  • We still have the problem of two different Keys in the report :(

    Let's see what happens if we now try and rebuild the Licensing Store...

     

    Recreate the Licensing Store

    • Go to Start > All Programs > Accessories
    • Right-Click      on Command Prompt and select Run as      Administrator - accept the UAC prompt
    •  Run the following commands in the Command      Prompt window, using the Enter key at the end of each

     

    net stop sppsvc

    (wait until the service has stopped before entering the following lines)

     

    CD %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform

    REN tokens.dat tokens.bar
    net start sppsvc
    slui.exe

     

    • After a      couple of seconds Windows Activation dialog will appear.
    • You may be      asked to re-activate and/or re-enter your product key or Activation may      occur automatically.
    • If you are      asked for your Key, use the one on the COA sticker on the machine's case

     

    Reboot and Post back with a new MGADiag report


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, October 1, 2012 8:18 PM
    Moderator
  • Ok did this and got the error message when pressing the Copy button on te MGA.  Here is the log mgadiag-100112.txt: https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!148&authkey=!ABlbwpJpJoPSp8M

    The tokens.dat was not rebuilt.


    andy

    Monday, October 1, 2012 9:54 PM
  • (excuse me while I try and recover from culture-shock - I've just seen the mess that MS have made of the sister Answers forums, for the first time!)

    The 'schizophrenic' licensing is still present :(

    What Key did you enter when asked? the one ending in MX9QY ??

    Please run the following commands, and post the results - I'll try and work out what's happening......

    DIR %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform

    ICACLS %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform

    ICACLS %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens*.* /T

    ICACLS C:\Windows\System32\7b*.* /T

    Please also Export from Event Viewer teh Windows Application and Windows System logs, compress them, and upload them to your public SkyDrive - they may help me get a handle on it.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, October 1, 2012 10:16 PM
    Moderator
  • Noel,

    When I ran the slui.exe I was not prompted for a key.  The last key I entered (many steps ago) ended in 9QY.

    I ran the cmds you gave and all ran with out error except the last one.  the log is ical.txt at: https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!149&authkey=!ADgteCIP_AtJhks


    andy

    Tuesday, October 2, 2012 3:47 AM
  • (thought I'd responded to this!)

    Please  Export from Event Viewer the Windows Application and Windows System logs, compress them, and upload them to your public SkyDrive - they may help me get a handle on it.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Wednesday, October 3, 2012 12:25 AM
    Moderator
  • Wednesday, October 3, 2012 3:02 AM
  • The machine is still complaining about  the file system :(

    Please run another CHKDSK C: /R and see what it reports - the log will be in teh Application Events and a Wininit entry.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Wednesday, October 3, 2012 9:10 AM
    Moderator
  • The CHKDSK finished at 16:11 - and at 16:29 the system again complained that teh filesystem is damaged.

    In between,

     - a remote client service was installed - Bomgar Support - which I've never heard of before.

     - QuickBooks threw three errors in quick succession

     - the SPP Service seemingly approved of your license for both Office and Windows

     - PID 2188 tried to disable the Desktop Window Manager service.

    - PID 2020 tried to disable the Desktop Window Manager service

    This smells of malware -

    Please download and install  Malwarebytes Anti-malware (free version) from  www.malwarebytes.org - UNtick 'Enable free trial of MBAM PRO' at the end of the installation -  and update it, then run a full scan  in your main account, and Quick scans in any other user accounts.

     

    Delete everything it finds   


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Wednesday, October 3, 2012 4:13 PM
    Moderator
  • Noel,

    Bomgar is an Enterprise class REmote Computer management system.  It is how I am accessing this PC.

    QB does lock up on occassion and that is why the 3 errors.

    Not sure what the two PIDs were but they are not running now.

    Ran a deep scan with Malwarebytes and if found nothing.


    andy

    Thursday, October 4, 2012 5:56 AM
  • The PID for the Desktop disabler seems to change with ever attempt to stop/disable the service -

    I suggest that you have a look in the Event Viewer, and see what the latest PID for it is, and then try and track it - or use something like ProcMon or Process Explorer to see if you can trap it.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, October 4, 2012 7:23 AM
    Moderator
  • Noel,

    Sorry for being MIA for last week but had been away.  All was working ok until the MS Update ran last night.  After the reboot, getting Counterfit errors and the Desktp say not Genuine.  I rani Slui.exer and Get the message that Windows must be Restored.  Ugh.   :(

    I looked through the Event Log and did find the NTFS errors but it looksa like it is moaning about issues in ShadowCopies as the error is like: "The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolumeShadowCopy8." and Copy10 and 15.  I'm inclined to turn off the System Restore to delete those copies as CHKDSK finds no errors.

    The Desktop Manager is being disabled by bomgar my remote access tool.  The is normal I'm told.

    Suggestions?

    Thursday, October 11, 2012 2:26 AM
  • I did wonder if perhaps Bomgar was responsible for the disabling.

    Resetting System Restore sounds like a good option.

    Let's take another MGADiag - no hurry. I'll make sure the thread isn't locked :)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, October 11, 2012 7:05 AM
    Moderator
  • Noel,

    Sorry for the delay but didn't get an email that you replied.

    I did reset System Restore so we'll see if the ntfs errors go way.  The mcDiag report is named mgaDiag (101112) and I also uploaded the mga cab file if that is of any use.  While I don't understand all tthe output, I see that the product key has reverted back to the original Dell OEM key instead of the COA Retail key.  The skydrive link is: https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!148&authkey=!ABlbwpJpJoPSp8M

    Thanks for your help.


    andy

    Friday, October 12, 2012 5:08 AM
  • That MGADiag is looking good!

    one minor error - which should be cleared by validating at www.microsoft.com/genuine/validate using Interent Explorer.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Friday, October 12, 2012 9:40 AM
    Moderator
  • Noel,

    I hit that URL and it ran it for awhile the gave me the window to "install genuine Windows".  When I run SLUI.exe i get the error that "Windows must be restored.  An authorizedchange was made to Windows. You must reinstall or restore Windows system files to activate."

    Here is the mcDiag report ("mcDiag(101212-2)"): https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!154&authkey=!AN4MQ1MAKBkXe70


    andy



    • Edited by andytheman Friday, October 12, 2012 2:52 PM
    Friday, October 12, 2012 2:09 PM
  • You're really ringning the changes on these reports! :)

    Thise one, there's again possible file corruption. -

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514
    Error: product key not found.

    reboot and post the results of this command

     

    DIR C:\Windows\System32\7b*.*  /ah

    These two files are normally rebuilt at every boot, so both should have the same timestamp, which should be at some point during the boot.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Friday, October 12, 2012 4:24 PM
    Moderator
  • Noel,

    Here you go:

    DIR C:\Windows\System32\7b*.* /ah

    C:\Windows\system32>DIR C:\Windows\System32\7b*.* /ah
     Volume in drive C has no label.
     Volume Serial Number is 3008-A429

     Directory of C:\Windows\System32

    10/12/2012  11:34 AM            25,920 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    10/12/2012  11:34 AM            25,920 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
                   2 File(s)         51,840 bytes
                   0 Dir(s)  136,863,232,000 bytes free

    C:\Windows\system32>DIR C:\Windows\System32\7b*.* /ah


    andy

    Friday, October 12, 2012 4:41 PM
  • The only thing I can thik of at this point is to try rebuilding the Licensing Store again.

    (Note the changes to line 6)

    Please first try recreating Licensing Store.

    Recreate the Licensing Store

    Go to Start > All Programs > Accessories

    Right-Click on Command Prompt and select Run as Administrator - accept the UAC prompt

    Run the following commands in the Command Prompt window, using the Enter key at the end of each

    net stop sppsvc

    (wait until the service has stopped before entering the following lines)

    CD %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
    REN tokens.dat tokens.bar3
    net start sppsvc
    slui.exe

    After a couple of seconds Windows Activation dialog will appear.

    You may be asked to re-activate and/or re-enter your product key or Activation may occur automatically.

    Reboot and Post back with a new MGADiag report



    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Friday, October 12, 2012 6:13 PM
    Moderator
  • Noel,

    Still gettind Wiundows System needs to be restored error.  So I ran "slui.exe 3" and re-entered my key.  While trying to activate I got an error saying that "The product key will not work with this edition of Windows 7.  You must eith run Window 7 Setup or enter a Windows 7 Jome Premium product key."  Very strange as the key I entered is a Win 7 Prem OA.

    mcDiag(101212-3).txt is at https://skydrive.live.com/redir?resid=ED7BDBD3D3BCA7DD!155&authkey=!APtqthgVWk9BzgY

    Next?


    andy


    • Edited by andytheman Friday, October 12, 2012 10:42 PM
    Friday, October 12, 2012 10:36 PM
  • Sorry about the delay, andy - ISP problems :(

    Catching up at the moment - back later.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, October 14, 2012 10:34 AM
    Moderator
  • Same error in the report - what happens if you try this...

    open an Elevated Command Prompt and run the following command

    C:\Windows\System32\slmgr.vbs /DLV

    What exact error popup do you get?


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, October 14, 2012 2:10 PM
    Moderator
  • Noel,

    Error from Windows Script Host: Sopftware licensing service version: 6.1.7601.17514 Error: product key not found.


    andy

    Sunday, October 14, 2012 3:19 PM
  • Bother! I was hoping for something other than that!

    I wonder if it's the registry Key itself that's the problem?

    Please run the folloing command

    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

    Post the results - but please first remove all but the first 5 characters from the DigitalProductID and DigitalProductID4 data! (they contain your Product Key in encrypted form), Instead, please quote the number of line each take up in the CMD window, and whether they are ALL zeros or what.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, October 14, 2012 4:25 PM
    Moderator
  • Noel,

    DigitalProductID is 5 lines  DigitalProductID4 is 33 lines. here is the query results with two ids cleaned:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
        CurrentVersion    REG_SZ    6.1
        CurrentBuild    REG_SZ    7601
        SoftwareType    REG_SZ    System
        CurrentType    REG_SZ    Multiprocessor Free
        InstallDate    REG_DWORD    0x4e550beb
        RegisteredOrganization    REG_SZ    Microsoft
        RegisteredOwner    REG_SZ    User
        SystemRoot    REG_SZ    C:\Windows
        InstallationType    REG_SZ    Client
        EditionID    REG_SZ    HomePremium
        ProductName    REG_SZ    Windows 7 Home Premium
        ProductId    REG_SZ    00359-OEM-8992687-00095
        DigitalProductId    REG_BINARY    A4000
        DigitalProductId4    REG_BINARY    F8040
        CurrentBuildNumber    REG_SZ    7601
        BuildLab    REG_SZ    7601.win7sp1_gdr.120830-0333
        BuildLabEx    REG_SZ    7601.17944.amd64fre.win7sp1_gdr.120830-0333
        BuildGUID    REG_SZ    56e8ba13-7029-4728-a506-2ddb4a0c3445
        CSDBuildNumber    REG_SZ    1130
        PathName    REG_SZ    C:\Windows
        CSDVersion    REG_SZ    Service Pack 1

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AdaptiveDisplayBrightness
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\APITracing
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ASR
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Console
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CorruptedFileRecovery
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DefaultProductKey
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DeviceDisplayObjects
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DiskDiagnostics
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\drivers.desc
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Event Viewer
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Management
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontDPI
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontMapper
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstalledFeatures
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\KnownFunctionTableDlls
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\KnownManagedDebuggingDlls
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\MCI Extensions
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\MCI32
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\MsiCorruptedFileRecovery
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NtVdm64
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NvCache
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\OpenGLDrivers
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerNet
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileLoader
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileNotification
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\related.desc
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\setup
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Superfetch
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Userinstallable.drivers
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WbemPerf
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Activation Technologies
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSATAPI
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF


    andy

    Sunday, October 14, 2012 6:20 PM
  • That all seems normal.

    I'm about out of ideas :(

    Tne next suggestion is the dreaded Repair install - see here for a tutorial on it  - http://www.sevenforums.com/tutorials/3413-repair-install.html

    I'm not sure how practical that'd be by remote?


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, October 14, 2012 6:36 PM
    Moderator
  • Noel,

    Did the repair install and Windows would not activate.  So I chose the Telephone activation which worked.  Windows is Genuine again.  I ran the MNCDiag and her eare the results are below.  Think it will last this time?

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-94PGM-PDW9J-MX9QY
    Windows Product Key Hash: 3aB/1LXNoIckdMqlUN+3JQM2THo=
    Windows Product ID: 00359-OEM-9804914-43223
    Windows Product ID Type: 8
    Windows License Type: COA SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {962DC190-3499-42B5-A1C8-C7F8B016EEB2}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_rtm.101119-1850
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
    File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{962DC190-3499-42B5-A1C8-C7F8B016EEB2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-MX9QY</PKey><PID>00359-OEM-9804914-43223</PID><PIDType>8</PIDType><SID>S-1-5-21-3548137055-96496508-2867800813</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1545                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A14</Version><SMBIOSVersion major="2" minor="4"/><Date>20091207000000.000000+000</Date></BIOS><HWID>84AA3A07018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
    Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00196-049-143223-02-1033-7601.0000-2882012
    Installation ID: 00534..................................................
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: MX9QY
    License Status: Licensed
    Remaining Windows rearm count: 0
    Trusted time: 10/14/2012 9:08:21 PM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: N/A
    HealthStatus: 0x0000000000000000
    Event Time Stamp: N/A
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: MAAAAAEAAQABAAMAAAABAAAAAgABAAEA6GHwUi6f2jPk1s5wdg4oH1RtmneeTEbK

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   DELL    WN09  
      FACP   DELL    WN09  
      HPET   DELL    WN09  
      MCFG   DELL    WN09  
      SLIC   DELL    WN09  
      SSDT   PmRef  CpuPm


    andy


    • Edited by andytheman Monday, October 15, 2012 2:17 AM
    Monday, October 15, 2012 2:13 AM
  • At least the two Product Key entries are now the same!

    Hopefully the repair will have fixed whatever caused the blockage, and it'll now stay fixed :)

    That report looks good to me.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, October 15, 2012 8:01 AM
    Moderator
  • Noel,

    Thanks for all of your help on this issue.  I do appreciate it!!


    andy

    Monday, October 15, 2012 1:36 PM
  • You're welcome - I've learned a few new wrinkles along the way as well.

    Good luck!


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Monday, October 15, 2012 1:43 PM
    Moderator
  • Worked Perfectly :)
    Thursday, January 10, 2013 7:46 PM
  • Ummm - what did? :)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of it contractors.

    Thursday, January 10, 2013 8:02 PM
    Moderator